Data protection information for prospective tenants and tenants (m/f/d), V.1.2 2022

It is very important for S.Boehme & Co. KGaA to observe all applicable regulations in data protection. The Basic Data Protection Regulation (GDPR) and the new Federal Data Protection Act (BDSG) stipulate that we fulfill comprehensive information obligations. We consider these obligations to be correct and take this responsibility very seriously. In the following document, we therefore explain to you what information, i.e. also so-called "personal data", we process about you as a prospective tenant or tenant (m/f/d) and inform you about the rights you have vis-à-vis s.boehme & Co. KGaA with regard to your personal data.

This data protection information is intended to be written in such a way that even legal laypersons can understand it - we hope we have succeeded. If you find any points unclear, please contact us - we will be pleased to explain our extensive data protection measures to you personally.

Who is this data protection information primarily aimed at?

This data protection information is intended for our prospective tenants and tenants.

Who is responsible for data processing?

The data controller for the processing of your personal data is our company, s.boehme & co. KGaA, Metzlerstraße 21, D-60594 Frankfurt am Main, Germany, telephone +49 69 8600 7227 0, fax +49 69 8600 7227 7, realestate@sboehme.com. When we write "we", "us" or "the company" in this data protection information, we always mean this company.

We are available at all times to answer any questions you may have about the processing of your personal data. You can reach us either via our contact details above or simply and directly via e-mail address dsb@sboehme.com.

What personal data do we process?

Our overriding principle for the processing of your personal data is: We only process data that you provide to us for the purpose of initiating and implementing the tenancy relationship if we are permitted to do so by a statutory provision or if the data subject, i.e. you, for example, has given us express consent to do so.

Depending on whether you are a prospective tenant or a tenant, this includes the following personal data:

After initial contact and for the viewing agreement:

Salutation, first name, last name, address of all prospective tenants,
E-mail address, telephone and, if applicable, fax numbers of all future lease partners,
Details of pets other than small animals that are to move into the apartment.

Additionally, upon your declaration of intent to rent an apartment:

Number of adults and children moving in,
If publicly subsidized housing, information on the identity of the persons moving in,
Occupation and employer of all leasing parties,
Information on consumer bankruptcy proceedings opened and pending,
Information on evictions carried out in the last 5 years or threatened in relation to an existing tenancy,
Information on your net income and the amount available to repay the rent.

In addition, if you have signed a lease agreement:

Before closing: If necessary, documents to prove the previous rent amount and the rent payments made (e.g. receipts owed by the previous tenant according to § 368 BGB or blackened bank statements and rental agreements),
Before closing: proof of salary / income (e.g. from salary statement, bank statement, income tax assessment with blackened non-required information).
account data,
Amount of rent and operating costs,
consumption/usage data and operating costs in accordance with BetrKV and HeizKV,
data on receipt of rent and operating costs,
Correspondence during the tenancy,
content data (e.g. text entries) in the contract.

For what purposes and on what legal basis do we process personal data?

Personal data is processed primarily for the purpose of establishing and implementing the tenancy, the legal basis for which is Art. 6 (1b) DSGVO (implementation of a contract with the data subject).

In the case of publicly subsidized housing, the processing is additionally carried out to fulfill legal obligations to which we are subject as the responsible party, the legal basis for this is Art. 6 (1c) DSGVO.

We may also process personal data on the basis of other legal obligations to which we are subject, pursuant to Art. 6 (1c) DSGVO. These include, above all, tax and commercial law retention and documentation obligations.

In addition, we process personal data to protect our legitimate interests pursuant to Article 6 (1) f) DSGVO, as long as we can assume that you have no overriding interest in our not collecting and processing this data for these purposes. Our legitimate interests include, for example.

The clarification of economic risks in connection with the tenancy, such as payment defaults,
the assertion of legal claims and the defense in legal disputes;
the prevention and investigation of criminal acts;
the management and optimization of our business activities, including risk management.
In the event of a pending sale of the building, gradual and appropriate disclosure of tenant-relevant data, particularly in the due diligence process, insofar as it is absolutely necessary for the sale. Tenant data will be anonymized or pseudonymized as far as possible.

Insofar as we give you the opportunity to give your consent to the processing of personal data, we will always process the data covered by the consent only for the purposes stated in the consent on the basis of Art.6 (1a) DSGVO. Please note the information on the right to object to the processing of personal data for legitimate interests under "What rights do data subjects have?".

Is there an obligation to provide personal data?

No, you are not obliged to provide personal data. However, we cannot establish or carry out a rental relationship with you without data. Therefore, the collection or provision of the above-mentioned data is required for this, unless we specify otherwise when collecting the data.

If we collect personal data in addition to the above, we will inform you at the time of collection whether the provision of this information is required by law or contract or is necessary for the conclusion of a contract. As a rule, we mark those data that you can provide voluntarily and whose collection is not based on an obligation or is not required for the conclusion of a contract.

Please see the information on the right to object to the processing of personal data to protect legitimate interests under "What rights do data subjects have?"

Who receives personal data from us?

Your personal data will generally be processed within our company. Depending on the specific type of personal data, only the departments and persons within our company have access to the data to the extent they need to carry out the purpose of the processing.

To the extent permitted by law, we may also transfer data to third parties outside our company to the extent absolutely necessary for the purpose. These external recipients may include in particular

Your landlord and his employees, if we act as the administrator of the rental property,
Employees of affiliated companies,
Employees of companies that process data on our behalf in accordance with instructions,
third parties, insofar as this is absolutely necessary for the implementation of the tenancy, but only with your consent (e.g. tradesmen to carry out maintenance or repair work on the rented property or meter-reading service providers to collect operating costs),
public authorities, e.g. registration authorities, in the case of publicly subsidized housing the Office for Housing;
Other tenants who are allowed to inspect original receipts and consumption records on which the respective annual statements are based,
Energy supply companies (e.g. meter readings after moving out),
Companies or agencies that support us in enforcing or defending legal claims (e.g. lawyers).
Third parties to whom we must transfer their data due to legal obligations (e.g. tax authorities).
Involved parties in the event of a planned sale of the building, i.e. prospective buyers insofar as disclosure is necessary in the due diligence process, as well as buyers and notaries.

Do we use automated decision-making?

As a matter of principle, we do not use automated decision-making within the meaning of Article 22 of the GDPR for our business relationships, which includes profiling in particular. If we use such procedures as an exception, we will inform the data subjects to the extent required by law.

Is data transferred to countries outside the EU or to international organizations?

Personal data is processed exclusively within the EU or the European Economic Area; there are no plans to transfer data to third countries.

For how long is personal data stored?

In principle, we delete personal data when it is no longer needed for the purpose for which it was collected. Data from rental agreements are therefore generally deleted when the rental agreement is terminated. However, data that is subject to statutory retention periods in particular is not deleted until the periods have expired. This applies, for example, to personal data in documents relevant under commercial and tax law. Deletion then usually takes place after a further 6 (HGB) or 10 years (AO). Deletion takes place without the data subject having to request us to do so. If we store personal data only for the purpose of fulfilling retention obligations, it is usually blocked in such a way that processing is only necessary in relation to the purpose of the retention obligation (e.g. for disclosure to tax authorities).

Data of interested parties who have not become tenants will be deleted no later than 6 months after the conclusion of a rental agreement for the property in question.

Data that we process in our legitimate interest will generally be stored by us as long as this legitimate interest exists and the interests of the data subject in not continuing the storage do not outweigh this.

If you have given us consent for processing, we store the data for the period agreed in the consent.

What rights do data subjects have?

Every data subject has the right

To information on the personal data stored about them in accordance with Article 15 GDPR;

to correction of incorrect or incomplete data in accordance with Article 16 GDPR;
to erasure of personal data, pursuant to Art. 17 GDPR;
to restriction of processing, pursuant to Art. 18 GDPR;
to data portability, pursuant to Art. 20 GDPR, and
to object, pursuant to Art. 21 GDPR: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the legal basis of our legitimate interest pursuant to Article 6(1f) GDPR. In the event of such an objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

To exercise your rights, you or the data subject may contact us at any time, e.g. via one of the contact channels mentioned in the section "Who is responsible for data processing?". If you have any questions regarding the processing of personal data, you or the data subject may contact our data protection officer at any time.

A data subject is also entitled to lodge a complaint with a competent data protection supervisory authority pursuant to Art. 77 GDPR.

Thank you for your interest in our data protection information.

Your s.boehme & Co. KGaA